Login performance

ABSTRACT

An embodiment of the invention may include a method, computer program product and system for receiving a request from a user to access a system. The user requesting access has an associated job function. The embodiment of the invention may include determining an access window for the job function of the user. The access window for the job function is a range of time where historical usage of the system by one or more users having the job function is above a threshold amount. The embodiment of the invention may include determining whether a time of access of the request is within the access window. The embodiment of the invention may include granting access to the system based on determining that the time of access of the request is within the access window.

BACKGROUND

The present invention relates to improved user performance of serverbased applications, and more specifically, to limiting user access basedon time of day and system load.

In computer security, logging in, (or logging on or signing in orsigning on), is the process by which an individual gains access to acomputer system, and access programs or files located on the computersystem, by identifying and authenticating themselves. The usercredentials are typically some form of “username” and a matching“password”, and these credentials themselves are sometimes referred toas a login, (or a logon or a sign in or a sign on).

BRIEF SUMMARY

An embodiment of the invention may include a method, computer programproduct and system for receiving a request from a user to access asystem. The user requesting access has an associated job function. Theembodiment of the invention may include determining an access window forthe job function of the user. The access window for the job function isa range of time where historical usage of the system by one or moreusers having the job function is above a threshold amount. Theembodiment of the invention may include determining whether a time ofaccess of the request is within the access window. The embodiment of theinvention may include granting access to the system based on determiningthat the time of access of the request is within the access window.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts a cloud computing environment according to an embodimentof the present invention;

FIG. 2 depicts abstraction model layers according to an embodiment ofthe present invention;

FIG. 3 illustrates a login system, in accordance with an embodiment ofthe invention;

FIGS. 4a and 4b are a flowchart illustrating the operations of theapplication authenticator of FIG. 3, in accordance with an embodiment ofthe invention; and

FIG. 5 is a block diagram depicting the hardware components of the loginsystem of FIG. 3, in accordance with an embodiment of the invention.

DETAILED DESCRIPTION

Embodiments of the present invention will now be described in detailwith reference to the accompanying Figures.

It is to be understood that although this disclosure includes a detaileddescription on cloud computing, implementation of the teachings recitedherein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g., networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported, providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based e-mail).The consumer does not manage or control the underlying cloudinfrastructure including network, servers, operating systems, storage,or even individual application capabilities, with the possible exceptionof limited user-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forload-balancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure that includes anetwork of interconnected nodes.

Referring now to FIG. 1, illustrative cloud computing environment 50 isdepicted. As shown, cloud computing environment 50 includes one or morecloud computing nodes 10 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 54A, desktop computer 54B, laptop computer 54C,and/or automobile computer system 54N may communicate. Nodes 10 maycommunicate with one another. They may be grouped (not shown) physicallyor virtually, in one or more networks, such as Private, Community,Public, or Hybrid clouds as described hereinabove, or a combinationthereof. This allows cloud computing environment 50 to offerinfrastructure, platforms and/or software as services for which a cloudconsumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 54A-N shownin FIG. 1 are intended to be illustrative only and that computing nodes10 and cloud computing environment 50 can communicate with any type ofcomputerized device over any type of network and/or network addressableconnection (e.g., using a web browser).

Referring now to FIG. 2, a set of functional abstraction layers providedby cloud computing environment 50 (FIG. 1) is shown. It should beunderstood in advance that the components, layers, and functions shownin FIG. 2 are intended to be illustrative only and embodiments of theinvention are not limited thereto. As depicted, the following layers andcorresponding functions are provided:

Hardware and software layer 60 includes hardware and softwarecomponents. Examples of hardware components include: mainframes 61; RISC(Reduced Instruction Set Computer) architecture based servers 62;servers 63; blade servers 64; storage devices 65; and networks andnetworking components 66. In some embodiments, software componentsinclude network application server software 67 and database software 68.

Virtualization layer 70 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers71; virtual storage 72; virtual networks 73, including virtual privatenetworks; virtual applications and operating systems 74; and virtualclients 75.

In one example, management layer 80 may provide the functions describedbelow. Resource provisioning 81 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 82provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In one example, these resources may include applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 83 provides access to the cloud computing environment forconsumers and system administrators. Service level management 84provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 85 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA.

Workloads layer 90 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 91; software development and lifecycle management 92; virtualclassroom education delivery 93; data analytics processing 94;transaction processing 95; and login program 96.

FIG. 3 illustrates login system 199, in accordance with an embodiment ofthe invention. In an example embodiment, login system 199 includes asecure device 110 and a user device 140 interconnected via a network198.

In the example embodiment, network 198 is the Internet, representing aworldwide collection of networks and gateways to support communicationsbetween devices connected to the Internet. Network 198 may include, forexample, wired, wireless or fiber optic connections. In otherembodiments, network 198 may be implemented as an intranet, a local areanetwork (LAN), or a wide area network (WAN). In general, network 198 canbe any combination of connections and protocols that will supportcommunications between the secure device 110 and the user device 140.

User device 140 may include a remote access program 142. User device 140may be a desktop computer, a notebook, a laptop computer, a tabletcomputer, a handheld device, a smart-phone, a thin client, or any otherelectronic device or computing system capable of receiving and sendingdata to and from other computing devices such as secure device 110 vianetwork 198, in order to logon to a secure system. User device 140 isdescribed in more detail with reference to FIG. 3.

Remote access program 142 may be a program, or subroutine contained in aprogram, that receives input from a user and communicates with theapplication authenticator 112, located on secure device 110, in order togain access to secure content 116 located on the secure device. Remoteaccess program 142 includes components used to receive input from a userand transmit the input to an application residing on secure device 110.In one example, the remote access application authenticator 112 receivesinput from a user, such as username and password, which is validated andauthenticated by the application authenticator 112 to identify the user.Once the password has been validated, remote access program 142 grantsthe user access to the information, services or applications located onsecure device 110, such as secure content 116.

Secure device 110 includes application authenticator 112, applicationlogin monitor 114 and secure content 116. In the example embodiment,secure device 110 is a server, desktop computer, a notebook, a laptopcomputer or any other electronic device or computing system capable ofreceiving and sending data to and from user device 140 via network 198,and capable of distributing the services and/or files located on securedevice 110. Although not shown, optionally, secure device 110 cancomprise a cluster of servers executing the same software tocollectively process the requests of multiple user and distribute therequisite services and/or files located on secure device 110. Securedevice 110 is described in more detail with reference to FIG. 3.

Application login monitor 114 is a database located on secure device 110containing details about each user authorized to access the securedevice 110. In an example embodiment, application login monitor 114contains information for each user such as, for example, role, title,location, login characteristics (frequency, time, duration), materialaccessed during login, or any other information pertinent to a user'spossible demand to the system. Additionally, application login monitormay contain more general operational characteristics, such as historicalperformance demand, performance requirements for specific tasks, etc.Application login monitor 114 is described in further detail below withregard to FIGS. 4a and 4 b.

Secure content 116 is a file located on secure device 110 containinginformation that has restricted access, either through passwordprotection or some other system of authentication. Secure content 116may be a database, web content, program modules, or any type ofinformation run on secure device 110 that a user could access.

Application authenticator 112 is a software application or configurationin a software application capable of receiving user credentials and fromremote access program 142, and authenticating a user to allow access tosecure content 116. Application authenticator additionally determineswhether a user should be allowed to access the secure content 116 basedon the user's role and whether the additional load the user may cause tothe system would impact overall performance. In addition, applicationauthenticator 112 contains performance evaluator 112A and usagecorrelator 112B in order to determine, and predict, load and impact.Performance evaluator 112A determines the current performance of thesystem, as well as determining historical performance due to retrievingand displaying relevant information located in secure content 116 to theuser. Performance evaluator 112A may additionally contain a historicalusage model of system performance, which may correlate historicalperformance trends to factors such as day of the week, time, holidays,season, etc., and may be used to return a predicted system usage forfuture time periods. Performance evaluator 112A may monitor and recordthe performance of network adaptor 912, processor(s) 904, RAM 916, cache918 or physical aspects of secure device 110. Usage correlator 112B maybe a model of usage for the user or for a global category of user, basedon information contained in application login monitor 114, whichattempts to predict a user's usage during any session based onhistorical data, such as activities performed by the user duringprevious sessions, and what times and dates those activities occurred.Additionally, usage correlator 112B may use historical usage containedin application login monitor 114 in order to create access windows,whereby behavior for a specific group of users is modeled based on thetime and date, and the group usage behaviors may be used to determinethat the group should have priority at specific days and times. Theoperations and functions of application authenticator 112 are describedin further detail below with regard to FIGS. 4a and 4 b.

FIGS. 4a and 4b show a flow chart illustrating the operations ofapplication authenticator 112 in accordance with an embodiment of theinvention. Referring to step S210, application authenticator 112receives an authentication that a user of user device 140 is authorizedto access secure content 116. The authentication may entail a userentering a user ID and password, or receiving information from remoteaccess program 142 that identifies and authorizes the user. As part ofthe authentication, application authenticator 112 receives uniqueinformation detailing the specific user, which may allow applicationauthenticator 112 to retain, or recall, information about that user'sprevious sessions.

In one example embodiment, application authenticator 112 receives arequest to authenticate a user attempting to access secure content 116.The request to authenticate a user may include a login request, where auser is prompted to enter a unique ID and password into a system, andthe application authenticator 112 confirms that the entered passwordmatches the password stored in a password database, where the storedpassword is associated with the unique ID.

Referring to step S220, application authenticator 112 determines theaccess window for the authenticated user. The access window is a pointin time where a user having a specified criterion (e.g. roll, title,location), will always be allowed to access the secure content 116following authentication. In one embodiment, the access window may be atime defined by a system administrator (e.g. 9 AM-5 PM) where a usershould always be granted access due to their responsibilities. Inanother embodiment, the access window may be determined using historicaldata, contained in application login monitor 114, for all users in aspecific role and/or time-zone to determine which periods of time thoseusers are most active, and infer that this activity should give suchusers priority over others. For example, the access window may bedetermined by instances where users of a certain group are above athreshold percentage of the overall system usage, or periods of timewhere users of a group are logged into the secure content 116 forprolonged periods of time. Additionally, the access window may bedetermined by the usage of the system by one or more users with thesame, or similar, job functions being above a threshold amount. In someembodiments, the access window may be adjusted based seasonal trends,day of the week, the occurrence of a holiday, or other factors that mayaffect usage.

Referring to step S230, application authenticator 112 determines if theuser is attempting to login at a time within the user's access window.If the user is within the access window, application authenticator 112proceeds to step S235. If the user is not within the access window,application authenticator proceeds to step S240.

Referring to step S235, the user is granted full access to the securecontent 116. The user is allowed to access or use any content containedin secure content 116 for as long as the user is logged into the system.The user may be logged into the system for a login duration (i.e. a setamount of time), whereby access to the secure content 116 is restrictedafter the user has been logged into the system longer than the loginduration. Following the restriction of access, the user may be promptedto login again (i.e. start at step S210) to regain access to the securecontent 116. In one embodiment, in step S235 the user may be grantedaccess for a relatively long login duration (e.g. 1 hour), as the useris within their access window, and the users load on the system does notfactor into determining whether the user should be granted access to thesecure content 116.

Referring to step S240, application authenticator 112 determines thecurrent load on the server. The load may be based on the amount ofprocessing power used, the amount of memory allocated, the bandwidthacross the network adaptor, or any other computer variable that mayimpact a user experience.

Additionally, application authenticator 112 may determine a thresholdload for the system. The threshold load may be a single variable, or acombination of multiple variables, that, alone or combined, would impactthe performance to a primary user of the system. The threshold load maybe set using an acceptable lag for primary users. For example, anacceptable load may be a 10 second response time for the user. In oneexample, the threshold load may be calculated using the greater ofeither the current load of the system, or the historical load of thesystem during similar conditions (e.g. time of day, day of week, monthof year). In an additional embodiment, the threshold load may be reducedby a buffer value, to ensure proper system performance for primaryusers. In one example, the buffer value may be the load added to thesystem if 50% of primary users were to access the system.

Referring to step S250, application authenticator 112 determines ifoverall load on the system is below the threshold load. If overall loadon the system is below the threshold load, application authenticator 112proceeds to step S275. If overall load on the system is above thethreshold load, application authenticator proceeds to step S260.

Referring to step S260, application authenticator 112 determines theuser's expected load to the secure content 116. The user's expected loadcan be determined using a model created from data contained inapplication login monitor 114. The model may correlate a user's usagewith factors, such as, day of the week, time, location and access deviceto determine what actions the user may make when accessing the securecontent 116. These actions may be cross-referenced to assigned valuesfor specific actions located in application login monitor 114, ordetermined using performance evaluator 112A, to determine a predictedload that the user may add to the system.

Referring to step S270, application authenticator 112 determines ifoverall load on the system when the user is added is below an impactload. The impact load may be may be a single variable, or a combinationof multiple variables, that, alone or combined, would impact theperformance to a primary user of the system. If overall load on thesystem is below an impact load, application authenticator 112 proceedsto step S275. If overall load on the system is above the impact load,application authenticator proceeds to step S280.

Referring to step S275, the user is granted full access to the securecontent 116. The user is allowed to access or use any content containedin secure content 116 for as long as the user is logged into the system.The user may be logged into the system for a login duration (i.e. a setamount of time), whereby access to the secure content 116 is restrictedafter the user has been logged into the system longer than the loginduration. Following the restriction of access, the user may be promptedto login again (i.e. start at step S210) to regain access to the securecontent 116. In one embodiment, in step S235 the user may be grantedaccess for moderate login duration (e.g. 30 minutes), as the user iswithin their access window, and the users load on the system does notfactor into determining whether the user should be granted access to thesecure content 116.

Referring to step S280, application authenticator 112 determines if anyadditional load on the system when the user is added would be below theimpact load. Additional load may be determined by finding the differencebetween current load and impact load, and search application loginmonitor 114 for any tasks that would be less than the differences inload. If any additional tasks could be performed such that the load onthe system is below an impact load, application authenticator 112proceeds to step S290. If there are no additional tasks could beperformed such that the load on the system would be below the impactload, application authenticator proceeds to step S295.

Referring to step S290, the user is granted partial access to the securecontent 116. Granting partial access to the user restricts certain typesof actions or content while accessing the secure content 116. Therestricted actions are those the user could undertake that put overallsystem load above the impact. The user may be logged into the system fora login duration (i.e. a set amount of time), whereby access to thesecure content 116 is restricted after the user has been logged into thesystem longer than the login duration. Following the restriction ofaccess, the user may be prompted to login again (i.e. start at stepS210) to regain access to the secure content 116. In one embodiment, instep S235 the user may be granted access for short login duration(e.g.10 minutes), as the user is within their access window, and the usersload on the system does not factor into determining whether the usershould be granted access to the secure content 116.

Referring to step S295, the user is denied access to the secure content116. In some embodiments, the user may be notified of the time windowdetermined in step S220, in which they are guaranteed access. Inadditional embodiments, the user may be notified of the denial of accessdue to overall system load.

FIG. 5 depicts a block diagram of components of secure device 110 anduser device 140, in accordance with an illustrative embodiment of thepresent invention. It should be appreciated that FIG. 5 provides only anillustration of one implementation and does not imply any limitationswith regard to the environments in which different embodiments may beimplemented. Many modifications to the depicted environment may be made.

Secure device 110 and user device 140 include communications fabric 902,which provides communications between computer processor(s) 904, memory906, persistent storage 908, communications unit 912, and input/output(I/O) interface(s) 914. Communications fabric 902 can be implementedwith any architecture designed for passing data and/or controlinformation between processors (such as microprocessors, communicationsand network processors, etc.), system memory, peripheral devices, andany other hardware components within a system. For example,communications fabric 902 can be implemented with one or more buses.

Memory 906 and persistent storage 908 are computer-readable storagemedia. In this embodiment, memory 906 includes random access memory(RAM) 916 and cache memory 918. In general, memory 906 can include anysuitable volatile or non-volatile computer-readable storage media.

The programs application authenticator 112, application login monitor114, and secure content 116 in secure device 110; and remote accessprogram 142 in user device 140 are stored in persistent storage 908 forexecution by one or more of the respective computer processors 904 viaone or more memories of memory 906. In this embodiment, persistentstorage 908 includes a magnetic hard disk drive. Alternatively, or inaddition to a magnetic hard disk drive, persistent storage 908 caninclude a solid state hard drive, a semiconductor storage device,read-only memory (ROM), erasable programmable read-only memory (EPROM),flash memory, or any other computer-readable storage media that iscapable of storing program instructions or digital information.

The media used by persistent storage 908 may also be removable. Forexample, a removable hard drive may be used for persistent storage 908.Other examples include optical and magnetic disks, thumb drives, andsmart cards that are inserted into a drive for transfer onto anothercomputer-readable storage medium that is also part of persistent storage908.

Communications unit 912, in these examples, provides for communicationswith other data processing systems or devices. In these examples,communications unit 912 includes one or more network interface cards.Communications unit 912 may provide communications through the use ofeither or both physical and wireless communications links. The programsapplication authenticator, application login monitor 114, user interface116, and user display 128 in secure device 110; and remote accessprogram 142 in user device 140 may be downloaded to persistent storage908 through communications unit 912.

I/O interface(s) 914 allows for input and output of data with otherdevices that may be connected to secure device 110 and user device 140.For example, I/O interface 914 may provide a connection to externaldevices 920 such as a keyboard, keypad, a touch screen, and/or someother suitable input device. External devices 920 can also includeportable computer-readable storage media such as, for example, thumbdrives, portable optical or magnetic disks, and memory cards. Softwareand data used to practice embodiments of the present invention, e.g.,The programs application authenticator 112, application login monitor114, and secure content 116 in secure device 110; and remote accessprogram 142 in user device 140, can be stored on such portablecomputer-readable storage media and can be loaded onto persistentstorage 908 via I/O interface(s) 914. I/O interface(s) 914 can alsoconnect to a display 922.

Display 922 provides a mechanism to display data to a user and may be,for example, a computer monitor.

The programs described herein are identified based upon the applicationfor which they are implemented in a specific embodiment of theinvention. However, it should be appreciated that any particular programnomenclature herein is used merely for convenience, and thus theinvention should not be limited to use solely in any specificapplication identified and/or implied by such nomenclature.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) having computer readable program instructions thereonfor causing a processor to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, configuration data for integrated circuitry, oreither source code or object code written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Smalltalk, C++, or the like, and procedural programminglanguages, such as the “C” programming language or similar programminglanguages. The computer readable program instructions may executeentirely on the user's computer, partly on the user's computer, as astand-alone software package, partly on the user's computer and partlyon a remote computer or entirely on the remote computer or server. Inthe latter scenario, the remote computer may be connected to the user'scomputer through any type of network, including a local area network(LAN) or a wide area network (WAN), or the connection may be made to anexternal computer (for example, through the Internet using an InternetService Provider). In some embodiments, electronic circuitry including,for example, programmable logic circuitry, field-programmable gatearrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the blocks may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

While steps of the disclosed method and components of the disclosedsystems and environments have been sequentially or serially identifiedusing numbers and letters, such numbering or lettering is not anindication that such steps must be performed in the order recited, andis merely provided to facilitate clear referencing of the method'ssteps. Furthermore, steps of the method may be performed in parallel toperform their described functionality.

1-7. (canceled)
 8. A computer program product for granting user access,the computer program product comprising: one or more computer-readablestorage devices and program instructions stored on at least one of theone or more tangible storage devices, the program instructionscomprising: program instructions to receive a request from a user toaccess a system, wherein the user has an associated job function;program instructions to determine an access window for the job functionof the user, wherein the access window for the job function is a rangeof time where historical usage of the system by one or more users havingthe job function is above a threshold amount; program instructions todetermine whether a time of access of the request is within the accesswindow; and based on determining that the time of access of the requestis within the access window, program instructions to grant access to thesystem.
 9. The computer program product of claim 8, further comprising:based on determining that the time of access of the request is notwithin the access window, program instructions to determine whether acurrent load on the system is below a threshold value; and based ondetermining that the current load on the system is below a thresholdvalue, program instructions to grant access to the system.
 10. Thecomputer program product of claim 8, further comprising: based ondetermining that the time of access of the request is not within theaccess window, program instructions to determine whether a predictedload on the system corresponding to the time of access is below athreshold value, wherein the predicted load of the system correspondingto the time of access is an estimated load on the system determinedbased on a historical performance of the system during correspondinghistorical times of access; and based on determining that the predictedload on the system is below a threshold value, program instructions togrant access to the system.
 11. The computer program product of claim 8,further comprising: based on determining that the time of access of therequest is not within the access window, program instructions todetermine a predicted user load on the system for the user, wherein thepredicted user load on the system is based on historical actionsperformed by the user and a load on the system caused by each historicalaction performed by the user; program instructions to determine whetherthe predicted user load on the system and a current load on the systemis below a threshold value; and based on determining that the predicteduser load on the system and a current load on the system is below athreshold value, program instructions to grant access to the system. 12.The computer program product of claim 11, further comprising: based ondetermining that the predicted load on the system and the current loadon the system is above a threshold value, program instructions todetermine whether there are one or more possible actions, wherein a loadcorresponding to the one or more possible actions and the current loadon the system is below the threshold value; and based on determiningthat there are one or more possible actions, program instructions togrant access to the system, wherein granting access to the systemconsists of performing the one or more possible actions for the system.13. The computer program product of claim 9, wherein the current loadcomprises one or more of processor performance of the system, memoryallocated of the system, and a bandwidth across a network adaptor of thesystem.
 14. The computer program product of claim 10, wherein theprogram instructions to determine the predicted load on the systemcomprise: program instructions to create a load model correlating ahistorical system load to a historical time of access; and programinstructions to determine the predicted load based on cross-referencingthe time of access to the load model.
 15. A computer system for grantinguser access, the computer system comprising: one or more processors, oneor more computer-readable memories, one or more computer-readabletangible storage devices, and program instructions stored on at leastone of the one or more storage devices for execution by at least one ofthe one or more processors via at least one of the one or more memories,the program instructions comprising: program instructions to receive arequest from a user to access a system, wherein the user has anassociated job function; program instructions to determine an accesswindow for the job function of the user, wherein the access window forthe job function is a range of time where historical usage of the systemby one or more users having the job function is above a thresholdamount; program instructions to determine whether a time of access ofthe request is within the access window; and based on determining thatthe time of access of the request is within the access window, programinstructions to grant access to the system.
 16. The computer system ofclaim 15, further comprising: based on determining that the time ofaccess of the request is not within the access window, programinstructions to determine whether a current load on the system is belowa threshold value; and based on determining that the current load on thesystem is below a threshold value, program instructions to grant accessto the system.
 17. The computer system of claim 15, further comprising:based on determining that the time of access of the request is notwithin the access window, program instructions to determine whether apredicted load on the system corresponding to the time of access isbelow a threshold value, wherein the predicted load of the systemcorresponding to the time of access is an estimated load on the systemdetermined based on a historical performance of the system duringcorresponding historical times of access; and based on determining thatthe predicted load on the system is below a threshold value, programinstructions to grant access to the system.
 18. The computer system ofclaim 15, further comprising: based on determining that the time ofaccess of the request is not within the access window, programinstructions to determine a predicted user load on the system for theuser, wherein the predicted user load on the system is based onhistorical actions performed by the user and a load on the system causedby each historical action performed by the user; program instructions todetermine whether the predicted user load on the system and a currentload on the system is below a threshold value; and based on determiningthat the predicted user load on the system and a current load on thesystem is below a threshold value, program instructions to grant accessto the system.
 19. The computer system of claim 18, further comprising:based on determining that the predicted load on the system and thecurrent load on the system is above a threshold value, programinstructions to determine whether there are one or more possibleactions, wherein a load corresponding to the one or more possibleactions and the current load on the system is below the threshold value;and based on determining that there are one or more possible actions,program instructions to grant access to the system, wherein grantingaccess to the system consists of performing the one or more possibleactions for the system.
 20. The computer system of claim 16, wherein thecurrent load comprises one or more of processor performance of thesystem, memory allocated of the system, and a bandwidth across a networkadaptor of the system.